Probability-based delay scheme for resisting SDN scanning

Scanning attack is usually the precursory step to attack a network by which adversaries gather significant information of the network and employ it to discover the vulnerabilities and save their precious time. Recently, researchers have proved that adversaries can scan a SDN network utilizing packets response time difference. In this paper, a probability-based delay scheme is introduced to combat this kind of scanning. An unpredictable delay strategy is proposed, which delays packets sent to SDN network within an adjustable probability to achieve moving target defense (MTD). The strategy aims at confusing the time information received by adversaries and reduce the performance cost as much as possible. Furthermore, analytical reasoning and an experiment of our implementation on a programmable SDN environment indicates that this delay strategy can effectively impact the statistical result of a scanning attack, and introduce a little performance penalties for the SDN network.